# Ensure Security Groups are Attached to ENIs

- Source: https://support.icompaas.com/support/solutions/articles/62000228267-ensure-security-groups-are-attached-to-enis
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description**:

The AWS ENI (**AWS Elastic Network Interface**) is a virtual network card that can be attached to any instance of the Amazon Elastic Compute Cloud (EC2). The purpose of these devices is to enable network connectivity for your instances. An elastic network interface is a logical networking component in a VPC that represents a virtual network card. Every network interface has a security group, which may be the default or a new security group.

## **Rationale**:

A security group acts as a virtual firewall, controlling the traffic that is allowed to reach and leave the resources that it is associated with.

## **Impact:**

A security group is attached to an ENI; with this approach, we can have multiple routes to the same EC2 instance with different security configurations.

## **Default value:**

By default, security groups are not attached to network interfaces.

## **Pre-Requisite:**

-   Security group
    

## **Remediation:**

### **Test Plan:**

-   **AWS Console Process**
    

1.  Open the **Amazon EC2** console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/").
    
2.  In the navigation pane, choose **Security groups. ![](https://support.icompaas.com/assets/kb/44ba10e5fe2baa1f.png)** 
    
3.  Click on a security group you want to verity if it connected to ENI (Elastic Network Interface).
4.  Copy the security group ID.![](https://support.icompaas.com/assets/kb/b8636e34c19107af.png)
5.  Now in the navigation pane, choose Network Interfaces.![](https://support.icompaas.com/assets/kb/04c42927be5541c0.png)
6.  In the search pane, select security group IDs filter and paste the security group ID.  ![](https://support.icompaas.com/assets/kb/d0815971157dc1f9.png)  
7.  Results will show if the security group is attached to Network Interface. 
    
      
    

  

**Using AWS CLI:**

  

aws ec2 describe-network-interfaces --filters group-id <value>

### **Implementation Plan:**

-   **AWS Console Process**
    

1.  Open the **Amazon EC2** console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/").
    
2.  In the navigation pane, choose **Network Interfaces**. ![](https://support.icompaas.com/assets/kb/bf3e84e6b400284b.png)
    
3.  Choose **Create network interface**.
4.  **(Optional)** For **Description**, enter a descriptive name.![](https://support.icompaas.com/assets/kb/29d6053b5f4c6d42.png)
5.  For **Security groups**, select desired security groups.  ![](https://support.icompaas.com/assets/kb/a787604c3d5fde99.png)
6.  **(Optional)** For each tag, choose Add new tag and enter a tag key and an optional tag value.
    
7.  Choose **Create network interface. ![](https://support.icompaas.com/assets/kb/a392edf78ceb8d5c.png)** 
    

  

**Using AWS CLI:**

**This example creates a network interface for the specified subnet.** 

aws ec2 create-network-interface --subnet-id subnet-9d4a7b6c --description "my network interface" --groups sg-903004f8 --private-ip-address 10.0.2.17

### **Backout plan:**

-   **AWS Console Process**
    

1.  Open the **Amazon EC2** console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/").
    
2.  In the navigation pane, choose **Network Interfaces**. ![](https://support.icompaas.com/assets/kb/e6f513e2551c41f5.png)
    
3.  Select the desired network interface and click on actions
4.  Select delete.

  

**Using AWS CLI:**

**This example deletes the specified network interface. If the command succeeds, no output is returned.** 

  

aws ec2 delete-network-interface --network-interface-id eni-e5aa89a3

### **References:**

[create-network-interface — AWS CLI 1.27.37 Command Reference (amazon.com)](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-interface.html "https://docs.aws.amazon.com/cli/latest/reference/ec2/create-network-interface.html")

[delete-network-interface — AWS CLI 1.27.37 Command Reference (amazon.com)](https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-network-interface.html "https://docs.aws.amazon.com/cli/latest/reference/ec2/delete-network-interface.html")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.